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VOLUME VI 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx-xx-9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer-Henderson Hall, 

Fort Myer, VA 22211 

/ 



The Hearing in the above-entitled matter was 
held on Wednesday, June 12, 2013, at 9:30 a.m., at Fort 
Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge . 
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DISCLAIMER 

This transcript was made by a court 
reporter who is not the official Government reporter, 
was not permitted to be in the actual courtroom where 
the proceedings took place, but in a media room 
listening to and watching live audio/video feed, not 
permitted to make an audio backup recording for 
editing purposes, and not having the ability to 
control the proceedings in order to produce an 
accurate verbatim transcript . 

This unedited, uncertified draft 
transcript may contain court reporting outlines that 
are not translated, notes made by the reporter for 
editing purposes, misspelled terms and names, word 
combinations that do not make sense, and missing 
testimony or colloquy due to being inaudible to the 
reporter . 
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PROCEEDING, 
THE COURT: Major Fein, please account for 

the parties . 

MR. FEIN: Your Honor, all parties in the 
court when the court last recessed are again present . 

THE COURT: Is the government ready to 

proceed? 

MR. FEIN: Yes, ma'am. 

THE COURT: Are there any issues we need on 
address before we proceed? 

MR. FEIN: No, ma'am. 

MR . COOMBS : No , Your Honor . 

THE COURT: All right. Proceed. 

MR. MORROW: The government recalls Mr. Mark 

Johnson . 

Mr. Johnson, I just want to remind you you're 
still under oath. 

THE WITNESS: Yes, sir. 

Whereupon : 

MARK JOHNSON, 
recalled as a witness, having been previously duly 
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sworn according to law, testified as follows : 
DIRECT EXAMINATION BY MR. MORROW: 

Q. Mr. Johnson, we discussed your examination of 

an external hard disk drive earlier. What other pieces 
of evidence did you examine in this case? 

A. We examined a forensic image obtained from PFC 

Manning ' s Mac Book Pro computer or laptop . 

Q. You said a Mac Book Pro laptop? 

A. Mac Book Pro laptop. 

THE COURT: A Mac? 

THE WITNESS: A Mac Book Pro, Your Honor. 
BY MR. MORROW: 

Q. Who makes that, a Mac Book Pro? 

A. Apple Computer. 

Q. And what exactly did you examine? 

A. I examined the forensic image of the hard 

drive obtained from that laptop. 

Q. And before beginning your examination, what 

did you do first? 

A. Retrieved the evidence from our evidence 

storage, brought it to my work station, made a local 
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copy, working copy, validated the image hash both with 
the embedded image hash as well as compared with the 
notes obtained from the acquiring agent . 

THE COURT: Can I interrupt you for just a 
minute? I asked where did the computer come from. 
BY MR. MORROW: 

Q. Mr. Johnson, where was this computer collected 

from? 

A. The computer was collected from PFC Manning's 

housing unit in Iraq at FOB Hammer. 

Q. And what kind of operating system did this 

computer have? 

A. The Mac OS 10. 

Q. And what is Mac OS 10? 

A. OS 10 is the operating system used by Apple 

Computers for Macintosh computers . 

Q. And when was this operating system installed 

on the computer? 

A. 25 January of 2010. 

Q. And how do you know? 

A. We obtained the installation log from the 
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operating system installation log of the hard drive . 

Q. And where is the installation log located on 

the computer? 

A. The system log folder. 

Q. I'm retrieving prosecution exhibit 126 for 

identification. 126 Alpha and Bravo. Excuse me. 

I'm handing the witness what's been marked as 
prosecution exhibit 126 Alpha and 126 Bravo. Just feel 
free to extract both. 

Mr. Johnson, do you recognize that document? 
A. I do. 

Q. And what is it? 

A. This is the contents of the install log 

obtained from the Mac Book Pro ' s hard drive . 
Q. Is that the entire install log? 

A. I believe it is, sir. 

MR. MORROW: Permission to publish to the 
court, Your Honor. 

THE COURT: Proceed. 
BY MR. MORROW: 

Q. Mr. Johnson, I'm going to show you 126 Alpha 
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first. Using this exhibit, can you explain your 
testimony earlier about the installation of the operating 
system? 

A. The installation log is created by the OS 10 

and it logs number of actions related to the installation 
of the operating system. On line number 6 there you can 
actually annotate where it ' s starting itself on January 
25. 

MR. TOOMAN: Your Honor, the defense will 
stipulate that the operating system was installed on 25 
January . 

THE COURT: All right. 
MR. MORROW: Okay. 
BY MR. MORROW: 

Q. Mr. Johnson, I'm going to show you page two of 

126 Bravo. Can you explain what else you observed in the 
install log? 

A. If you look at line number 33 here, you'll 

note that it ' s wipe and secure erase . This was an option 
selected during the installation to securely wipe the 
hard drive during the installation process prior to the 
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(INAUDIBLE) being installed. 

Q. Now, what do you mean by wipe and secure 

erase, what does that actually mean? What is the 
computer actually doing? 

A. It's clearing the storage on the hard drive 

and writing out with zeroes . 

THE COURT: What line is that? 
THE WITNESS: Line number 33, ma'am. 
MR. MORROW: Your Honor, the government moves 
to admit prosecution exhibit Alpha and Bravo 126 for 
identification . 

MR. TOOMAN: No objection. 
THE COURT: May I see them, please? 
Prosecution exhibits 126 Alpha and Bravo are admitted. 
BY MR. MORROW: 

Q. Mr. Johnson, what was your investigative plan 

for the computer? 

A. In this case we were looking for evidence of 

chat communications or indications of classified 
information . 

Q. So what's the first thing you did? 
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A. We were looking to see if there was any chat, 

programs installed on this program — on the computer, 
and if so, what information may have been logged. 
Q. And what did you find? 

We identified the ADM program was installed. 
And what is ADM? 

ADM is a chat program used on the OS 10 . 
And did you find any chat logs in the ADM 



A 

Q 
A 

Q 

program? 
A. 

Q. 
A. 

Q. 



We did. 

And who are those chats between? 
Private Manning and Adrian Lamo . 
Did the ADM application contain evidence of 
any other communications? 

A. Yeah. We looked in PFC Manning's buddy list 

for the ADM program to see who else he might have been 
communicating with. We identified one entry that was of 
interest indicating the chat account pressassociation was 
associated with an alias of Julian Assange. 

Q. All right. Let's back up a little bit. 

What's a buddy list? 
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A. Buddy list is your list of friends or contacts 

that you would be chatting with in a chat program. 

Q. And what is an alias that you're talking about 

in this context? 

A. In this context an alias would be a nickname 

or user supplied contact name . 

Q. And the name Julian Assange was associated 

with what account? 

A. The chat account pressassociation . 

Q. I'm showing you what's been marked as 

prosecution exhibit 120 for identification. I'm handing 
the witness what's been marked as prosecution exhibit 120 
for identification. 

Do you recognize those images, Mr. Johnson? 

A . I do . 

Q. And what are they? 

A. The first one here is the, an excerpt of the 

buddy list showing the contact pressassociation 
associated with Julian Assange. The second is an excerpt 
obtained from an unallocated cluster referring to 
pressassociation from with the alias of a Nathaniel 
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Frank . 

MR. MORROW: Permission to publish, Your 

Honor . 

THE COURT: Granted. 
BY MR. MORROW: 

Q. All right. Let's look at page one of 

prosecution exhibit 120 for ID. Can you just repeat or 
just explain the image as it appears on the screen, 
please? 

A. Yeah. This is an excerpt contained from the 

buddy list. It shows the buddy account of dog network, 
which is associated with PFC Manning on his computer . 
The chat remote person is pressassociation at jabber dot 
DE which I typically refer to as pressassociation, the 
alias below it, Julian Assange is the nickname. 

Q. Was jabber dot DE? 

A. That is a remote host that is used for Jabber 

Communications . 

Q. And what's Jabber? 

A. Jabber is a chat network, it's used by a 

number of sources . Until fairly recently it was very 
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similar to Google Talk. 

Q. And where did you find this on the computer? 

A. This one was found in the ADM's configuration 

folder . 

Q. On so on the allocated or unallocated side? 

A. This one was allocated, sir. 

Q. I'm going to show you page two of prosecution 

exhibit 120 for ID. Can you explain this image, please? 

A. This one is an excerpt taken from an 

unallocated cluster which appears to have been a deleted 
or removed entry for that same pressassociation account, 
also associated with dog network. This time, however, 
it ' s showing the alias of Nathaniel Frank . 

Q. And where did you find this information on the 

computer? 

A. This is in an unallocated cluster, sir. 

Q. Again, what does that mean for the for the 

court ? 

A. An unallocated cluster is deleted contents of 

former files. 

MR. MORROW: Your Honor, prosecution moves to 
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admit, prosecution exhibit 120 for ID into evidence. 
MR. TOOMAN: No objection. 
THE COURT: Prosecution exhibit 120 for 
identification is admitted. 
BY MR. MORROW: 

Q. Now, Mr. Johnson, we talked about this before, 

but how do you search allocated space on a computer? 

A. It would depend on the situation. Often times 

we 1 re using keyword searches for things we already know . 

Q. Just can you give me an example? 

A. For example, in this case I would be looking 

for pressassociation or Nathaniel Frank. 

Q. And so you'd use — how would you use that 

keyword with a forensic tool? 

A. We use the keyword search in the EnCase tool 

to find matches . 

Q. So after you found the pressassociation 

account in the unallocated space, what did you do next? 

A. Well, now that we have an additional alias 

Nathaniel Frank, we're going to look for other chats with 
that alias with pressassociation to see if there was any 
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other remnants of that account. 

Q. And what did you find? 

A. We found a large list of other what appear to 

be chats with Nathaniel Frank, between Nathaniel Frank 
and Bradley Manning. 

Q. And where did you find these chats on the 

computer? 

A. Unallocated space, sir. 

Q. And were these chats, was it all in one file, 

like all put together? 

A. No. They were in a number of chunks, split up 

in the unallocated space. 

Q. And were the chats readable to humans? 

A. They are readable, but they are fragments of 

XML used by ADM, so they 1 re readable but they ' re not easy 
to read by a human. 

Q. You said XML. What is XML? 

A. XML is a language used by a number of 

applications, web browsers and other applications. It's 
intended for ease of computers to parse data . It's not 
really intended for human consumption, but it is 
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readable . 

Q. Now, when you read through the contents of 

these chat logs in the unallocated space, what is the 
subject matter? 

A. They appear to be discussing government 

information . 

Q. Now, my understanding of unallocated space is 

that there's generally not a date associated with the 
information. Do these chat logs have dates? 

A. Yes, they did. That's true, when in 

unallocated space we often lose the metadata associated 
with the file because the file is no longer there. 
However, in this particular case the date and time with 
the chats is actually logged as part of the chat log 
entry, so it was recoverable. 

Q. Once you identified the chats in the 

unallocated space, what did you do next? 

A. After we identified the entries, we carved 

them out using EnCase, sent them out to an external file 
so I could make them more easy to read. 

Q. And what form did you put the chats in? 
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A. I converted them to an Excel spreadsheet. 

Q. Now, when you converted them to an Excel 

spreadsheet, did alter the files? 
A. No, sir. 

Q. And how did you organize these chats in the 

spreadsheet ? 

A. They were organized by date and time. 

Q. I'm showing you what's been marked as 

prosecution exhibit 123 for identification. 

I'm handing the witness what's been marked as 
prosecution exhibit 123 for identification. 

Mr. Johnson, do you recognize that document? 

A . I do . 

Q. And what is it? 

A. This is the contents of the spreadsheet I 

created in the chat extracted in unallocated space 
between Bradley Manning and the alias of Nathaniel Frank . 

Q. Permission to — actually, hold on a second. 

Now, did you create this document? 

A. Yes, sir. 

Q. And I assume when you created the document it 
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was a digital file, is that correct? 
A. Yes, sir. 

Q. Is this how the document would appear if 

printed? 

A. Yes, sir. 

MR. MORROW: Your Honor — well, more 

questions . 

Q. What's the first date of the chats that you 

were able to recover? 

A. March 5, 2010. 

Q. And what was the last date of the chats? 

A. March 18. 

Q. Now, did you recover chats for every day in 

between March 5 and March 18? 

A. I don't believe we have every single date. I 

don't recall specifically. 

No, there are dates missing, sir. 

Q. Now, is this the extent of the chats you were 

able to recover in the unallocated space? 

A. Yes, sir. 

Q. And you said something about government 
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information earlier . What government information did 
they discuss or did the parties discuss in the chat logs? 

A. They have a variety of topics here. 

Specifically they were mentioning Iceland, Iraq, 
Afghanistan and Gitmo . 

Q. And do the parties discuss WikiLeaks? 

A. Yes, sir. 

MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 123 for 
identification into evidence . 

MR. TOOMAN: No objection, ma'am. 
THE COURT : All right . Prosecution exhibit 
123 is admitted. 
BY MR. MORROW: 

Q. Mr. Johnson, let's talk about some of your 

other findings . Did you find any evidence of connections 
between this computer and other computers? 

A. Yes, sir. 

Q. Can you explain, please? 

A. Earlier during chat communications with Mr. 

Lamo he had discussed using SSH or SFTP to transfer 
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files, so I looked to see if he actually was using SSH or 
SFTP. 

Q. All right. So let's go very slowly. 

THE COURT: I was going to ask you, if you 
could speak just a little more slowly. I'm having 
difficulty understanding you. 

THE WITNESS: Sorry, Your Honor. 
Q. What is SSH? 

A. Secure shell. It is a computer program or 

computer protocol used for creating encrypted 
communication link between remote computers . 

Q. And what is SFTP? 

A. SFTP is a subset or works in conjunction with 

SSH. It stands for the secure file transfer protocol. 
It is to allow for transferring the files over the SSH 
communication link . 

Q. Now, when you looked at the — first of all, 

where did you find this SSH information? 

A. We found it in the known hosts file. That is 

a file that contains public key information of remote 
hosts that have been connected to at least once. 
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Q. And what do you mean by public key 

information? 

A. SSH using public key cryptography to handle 

the encryption between the hosts . The public key is 
stored locally so that you are able to encrypt the 
communication to the remote recipient . 

Q. And what did you observe in this known host 

file? 

A. Well, we saw several IP addresses and a URL 

connecting to ports that are unusual for SSH. They stood 
out because of that . 

Q. And were you able to resolve where these 

connections were made to? 

A. Yes, sir. 

Q. And where were they made to? 

A. The IP addresses and domain, one of them 

traced back by investigations to Verizon Communications 
that ultimately resolved back to Bradley Manning ' s aunt . 
The others resolved back to an ISP known as PRQ known to 
be associated with WikiLeaks . 

Q. And did you find any emails on the computer? 
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A. We did. 

Q. And where did you find emails? 

A. In his Thunderbird email cache. 

Q. And what is Thunderbird? 

A. Thunderbird is a client email program similar 

to Outlook used on a number of systems including Mac. 

Q. And when you say email cache, what do you mean 

by that? 

A. There's actually email in this cache of a 

Gmail account which is usually a storage server site, but 
when it's online with Thunderbird it will download. 

Q. So this email was stored locally on the 

computer? 

A. Yes, sir. 

Q. And what did you do with the email you found 

on this computer? 

A. We looked at the email to see if there was any 

relevant content . 

Q. And what do you mean by relevant content, what 

were you looking for? 

A. Specifically classified information, 
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discussions of government information and the like . 

Q. And what did you find in this email? 

A. Well, they identified a number of PGP or GPG 

encrypted emails . 

Q . All right . Let ' s start slowly with that 

again . What ' s PGP? 

A. PGP is pretty good privacy, a public key based 

encryption method used predominantly with email and GPG 
is the open source clone of that . 

Q. So they're basically the same? 

A. They are entirely compatible with one another. 

Q. Now, you said, were these messages encrypted? 

A. Yes, sir. 

Q. Did you find unencrypted messages? 

A. I did. 

Q. And was there anything of interest in some of 

the unencrypted messages? 

A. The unencrypted message indicated potentially 

a discussion of classified information. 

Q. So let's go back to you mentioned, you 

mentioned public keys a number of times. If an email is 
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encrypted, how does the other party read the email? 

A. With public key cryptography, in the case 

of — 

Q. Can you speak up a little bit, Mr. Johnson? 

A. I'm sorry. Pardon me. I'm not a loud talker. 

Public key cryptography is a concept of you 
only want the authorized recipient to be able to decrypt 
your message. PGP does this and so does (INAUDIBLE) 
based authentication, they use the same principles. The 
public key is from the recipient you have a corresponding 
secret key. They work mathematically with each other, so 
I can encrypt messages to someone and I can receive 
messages from them, but only that person can decrypt 
them. 

Q. Now, how does a forensic examiner go about 

decrypting email they find? 

A. Well, on this particular machine I can only 

decrypt the information that ' s been sent to me . I cannot 
see the messages that are being sent out because I don't 
have the recipient's public key, but I do have the secret 
key for PFC Manning because it ' s on his computer . All I 
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have to identify is the password necessary to open that 
private key. 

Q. And were you able to find the password for 

this private key? 

A. I was. 

Q. And how did you locate that? 

A. Well, when we have to decrypt things, we have 

to try to figure out what the password is, one of the 
things we look at is has he used passwords that we know 
of from his past . In the past his password was the same 
as the log-in password for the Mac. 

Q. And what do you mean by a log-in password for 

the user? 

A. All user accounts on the Mac are going to be 

password protected. They're normally set up at 
installation or possibly changed at a later date, even if 
the machine is set to auto log on. In this case the 
password is actually stored on the hard drive, we use a 
tool, the Mac forensics lab, to extract that log word. I 
can then compare it against the PGP and try it, and it 
worked. 
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Q. So the Mac word password was used on the 

private key in this case? 
A. Yes. 

Q. Now, once you figured that out, what were you 

able to do? 

A. At this point I can then run the encrypted 

messages through PGP myself and decrypt them. 

Q. And did you review the decrypted email? 

A. I did. 

Q. And what did you find? 

A. I found discussions of classified information, 

specifically Bradley Manning's role in the release of the 
Granahi video . 

THE COURT: Can you say that one more time? 

THE WITNESS: Specifically his involvement in 
the release of the collateral murder video . 



BY MR. MORROW: 

Q. I'm showing you prosecution exhibit 41? 

I'm handing the witness what's been marked as 
prosecution exhibit 41 for identification. 
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A. Yes, sir. 

Q. Do you recognize that document? 

A. I do. 

Q. And what is it? 

A. This is one of the emails between Bradley 

Manning and Mr. Eric Schmiedel obtained from his email 
account discussing classified information. 

Q. And can you just read — well, actually let me 

— permission to publish to the court, Your Honor. 
THE COURT: Go ahead. 

MR. MORROW: I'm just going to publish page 

one . 

BY MR. MORROW: 

Q. Mr. Johnson, is this the email you reviewed in 

PFC Manning's, or at least one of emails you reviewed? 

A. Yes, sir. 

Q. And just can you point out in the email the 

information we ' re talking about earlier? 

A. In this case what you can see here is an email 

thread. If you look about three-fourths of the way down 
you can see where you ' re seeing Bradley Manning ' s reply . 
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This is an answer, I have various other questions, and 
the very next line there, I approve the edits without 
reviewing the video. If you go back, you can see from 
this whole thing at the top here, my objection to 
collateral murder . This whole email is in relation to 
the collateral murder video . 

Q. And does the email discuss other government 

information that PFC Manning allegedly compromised? 

A. Yes, sir. We have a number of state 

department cables being discussed. 

MR. MORROW: Your Honor, the prosecution 
moves to admit prosecution exhibit 41 for identification 
into evidence . 

MR. TOOMAN: No objection, ma'am. 

THE COURT: May I see it, please? 

Prosecution exhibit 41 for identification is 

admitted. 

BY MR. MORROW: 

Q. Mr. Johnson, I want to talk or shift to some 

of the capabilities of this computer . Did this computer 
have a CD or a DVD system? 
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A. It did. 

Q. And are there any ways to tell whether a CD 

has been, a CD or a DVD has been written to or erased? 
A. Yes, sir. 

Q. And how would you tell this? 

A. In this case the operating system contains a 

disk recording log that keeps track of the number of 
actions related to the operation or eraser or erasure or 
re— erasure of rewritable disks . 

Q. And where did you find this disk recording 

log? 

A. It ' s in the log folder. 

Q. And how is this information created? 

A. It's maintained by the operating system 

itself . 

Q. And when you reviewed the disk recording log, 

what did you find? 

A. We found indications of a number of optical 

media being written and erased. 

Q. Say that again, please. 

A. Written and erased. 
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Q . I'm going to show you what. ' s been marked as 

prosecution exhibit 124 for ID. 

I'm handing the witness has been marked as 
prosecution exhibit 124 for identification. 

Mr. Johnson, can you review that document, 



please? 
A 

Q 
A 

Q 



It ' s the wrong document . 
Do you recognize the document? 
This is the utility log. 

I'm sorry. I retrieved the wrong exhibit. My 
apologies . One moment . 

What is the document, Mr. Johnson? 
A. This is the (INAUDIBLE) what appears to be the 

disk utility log. I'm sorry, sir. This is correct. 
This is the — 

THE COURT : I'm sorry . It ' s a what ? 
THE WITNESS: Disk recording log. 
THE COURT: Disk recording log. 
THE WITNESS: I do apologize. I was thrown 
off. I was seeing this without the line numbers until 
today . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 



32 

BY MR. MORROW: 

Q. Did you extract that document? 

A. Yes, sir. 

Q. Now, what's different from this document from 

what you extracted? 

A. It has had line numbers appended to it for 

clarity . 

MR. MORROW: Permission to publish, Your 

Honor . 

THE COURT: Go ahead. 
BY MR. MORROW: 

Q. I'm showing you page one of the disk recording 

log. Mr. Johnson, when was the first recording of a disk 
being written to? 

A. The log was indicating the first one in this 

case was January 30, 2010. 

Q. And I'm going to show you the last page of 

this exhibit, page five. What is the last recording in 
this case? 

A. April 30, 2010. 

Q. And what's that showing in line 189? 
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A. That an erasure has occurred. 

Q. And what does that mean? 

A. A rewritable disk, in this case a CD 

rewritable, has been erased. 

Q. Now, I showed you the other page of this log; 

what type of information is contained? 

A. You'll see a number of those series of both 

erasures and burns . 

MR. MORROW: Your Honor, the prosecution 
moves to admit prosecution exhibit 124 for identification 
into evidence . 

MR. TOOMAN: No objection, Your Honor. 
THE COURT: Prosecution exhibit 124 is 

admitted. 

BY MR. MORROW: 

Q. Now, this disk recording log, could you tell 

what files are on those CDs? 

A. No, sir. 

Q. And at any time in this case or during your 

examination did you search for file names that may have 
been on CDs that were burned or erased? 
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A. Yes, sir. 

Q. And what did you find? 

A. Previously I had identified a CD that had been 

obtained from PFC Manning's (INAUDIBLE) made in Iraq. We 
had a file name on that disk that was provided to me . We 
searched for that file name on the disk image of his Mac . 

Q. And do you recall the file name? 

A. I don't recall the entire file name, but it 

was partially engagement video . 

Q . I'm going to show you what ' s been marked as 

prosecution exhibit 121 for identification. 

I'm handing the witness what's been marked 
prosecution exhibit 121 for identification. Do you 
recognize that document? 

A . I do . 

Q. And what is it? 

A. This is a portion of unallocated space, a 

carve out portion that shows the file name in question in 
conjunction with some other text, specifically the word 
volumes and what appears to be additional file names . 

MR. MORROW: Permission to publish, Your 
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Honor . 

THE COURT: Yes. 
BY MR. MORROW: 

Q. Mr. Johnson, let's go through this just 

slowly. How is this document or image created? 

A. We're looking at the unallocated clusters in 

EnCase in a raw format. Since we don't have file or 
allocated information, we have to actually look at it 
raw. What you're seeing here is a snippet of that 
information it pulled from that as I would see it in 
EnCase ' s viewer . 

Q. Now, using this image, can you describe for 

the court the keyword you searched? 

A. If you look right there sort of in the middle 

of the page the July 07 CD engagement zone, the 
engagement zone is what I'm looking for. You can see the 
area around it is information that was obtained or 
related to it, specifically to the left you can see the 
word volumes and some numbers . 

Q. And what does volumes mean to you? 

A. On the Mac operating system the volumes is 
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used as a mounting point, that being you have to attach 
external media or removable media, whether that was CD, 
DVD, external hard drives, they have to be attached to 
the system to use them. Mac uses the word volumes as 
their mounting point . 

Q. What does volumes indicate to you then? 

A. Seeing a fragment like this in conjunction 

with a file name that I'm looking for would indicate to 
me that a file with that name was possibly contained on 
external media. 

Q. External media that was inserted into the 

computer? 

A. Yes, sir. 

Q. Now, once you found this excerpt in the 

unallocated space, what did you do next? 

A. Now that I see that he's got external media 

with content that's potentially relevant, I want to see 
if there's anything else of similar nature, so I'm 
looking for other volumes that might have been attached. 

Q. And what did you do when you — did you find 

any other volumes that might have been attached or any 
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evidence of any external media being attached? 
A. I did. 

Q. And what did you do once you found those other 

references? 

A. I went to find the other volumes by using a 

pattern, and doing so I found a large number of matches 
for the pattern. After I found those I identified all of 
them and extracted them at my examination work station. 

Q. I'm showing you what's been marked as 

prosecution exhibit 127 for identification. 

Mr. Johnson, I'm handing you what's been 
marked as prosecution exhibit 127 for identification. 
I'm going to hand the court reporter 121 for 
identification . 

Do you recognize that document? 

A. I do. 

Q. And what is it? 

A. This is the contents of a text file that I 

created showing all of the volumes we extracted from 
unallocated space . 

Q. And how did you create this file? 
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A. After we find all the matches in unallocated 

space, we carve out just the portion relevant. I'm 
looking for in this case file path. I had pulled them 
out into a text file where I can manipulate it to make it 
easier to read, in this case reducing duplicates, sorting 
it and creating this document . 

MR. MORROW: Permission to publish, Your 

Honor . 

THE COURT: Go ahead. 
BY MR. MORROW: 

Q. Mr. Johnson, I'm just going to show you the 

first page. Can you see that? 

A. Yes, sir. 

Q. Can you — how did you organize this document? 

A. It was sorted. 

Q. Sorted by what? Is this sorted by date? 

A. Yes, sir. 

Q. Let's just go through one line, we'll say line 

seven. Can you just explain from left to right the 
information? 

A. Sure. What you see here after it was 
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extracted is what appears to be the full path, the volume 
being the mount that I discussed earlier. The next thing 
would be the volume name . It has to have some sort of 
name, so in this case it appears to be using a date and 
time as its name, which is common. And then the last 
portion there you see line seven, 10 Reykjavik 21 would 
likely be a file name. 

Q. Now, let's just back up a little bit. I see 

100215 underscore 0621 in line seven. What does that 
mean? 

A. As I mentioned, all volumes or external media 

has to have a name of some sort. If you don't specify 
one, whatever application is used to create it will have 
to come up with one, and in most of those cases a date 
and time is used as a default and that appears to be the 
case here . 

Q. And would a Roxio program create that kind of 

default file name? 

A. I believe it does, sir. 

MR. MORROW: Your Honor, the prosecution 
moves to admit prosecution exhibit 127 for identification 
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into evidence . 

MR. TOOMAN: No objection, ma'am. 

THE COURT: May I see it, please? 

Prosecution exhibit 127 is admitted. 
BY MR. MORROW: 

Q. Now, Mr. Johnson, what was significant about 

some of the file names you saw in the prosecution exhibit 
127? 

A. They appear to have a similar or identical 

format to message record numbers . 

Q. And what about some of the others that are 

non-state department information? 

A. Could you be more specific, sir? 

Q. For example, Farah dot zip I believe was on 

page two. 

A . Okay . 

Q. Was there any evidence of that file name being 

on PFC Manning's SIPRNET computers? 

A. I'm sorry, sir. Did you say SIPRNET 

computers ? 

Q. Yes. 
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A. I believe that information was discovered by 

our agents, yes, sir. 

Q. Now, let's actually just roll back to some 

other information on the computer. Did you find any 
evidence of state department classified information or 
unclassified information on the personal computer of PFC 
Manning? 

A. Yes, sir. 

Q. And what did you find? 

A. We found a number of references to message 

record numbers which is a very unique structure . 
Q. And where did you find that? 

A. Unallocated space, sir. 

Q. And in the unallocated space or the allocated 

space, did you find any state department messages that 
were decoded in base64? 

A. No, sir. 

Q. Did you find anything that would encode a 

cable or state department cable in base64? 
A. Yes, sir. 

Q. And what did you find? 
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A. We identified what appears to be processing 

script intended to convert information from a cable to a 
base 6 4 common separated value format . 

Q. And did you attempt to use this script? 

A. I did. 

Q. And just describe the process of using the 

script, just go through it with the court, please. 

A. Well, after we review the contents of the 

script, we actually read through the content to see what 
it might do . We can see some very distinct things . It 
has fields related to message record numbers, 
classification in base64 . We also see a hard coded path 
pointing directly to PFC Manning ' s directory . After we 
extracted that using some sample of cables provided and 
it generated the output expected. 

Q. So let's take the 50,000 foot view. What did 

you put in and what did it spit out? 

A. The input is HTML files of state department 

files; the output is the common separated value files. 

Q. And with base64 encoded? 

A. Yes, sir. 
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Q. Now, did you find any evidence that this 

computer uploaded information to the WikiLeaks website? 

A. We found fragments of what appear to be 

references to the WikiLeaks page showing uploads of 
several file names, specifically file segment fragments 
to a WikiLeaks page . 

Q. And where did you find this evidence? 

A. It's in unallocated, sir. 

Q. And what files appear to have been uploaded to 

the WikiLeaks web page? 

A. What appear to be file name fragments are 

Farah dot RAR in segments . 

THE COURT : I'm sorry . 

Q. Spell it out. When you say Farah dot RAR, I 

think your accent may be confusing. 

A. Farah dot RAR is F A R A H dot RAR. 

Q. And what is an R A R file? 

A. RAR is an RAR archive. It is a compression 

and archiving format very similar to the more common zip 
that you 1 re probably familiar . 

THE COURT: Like a zip? 
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THE WITNESS: Very similar to a zip file, 

ma 'am. 

BY MR. MORROW: 

Q. And when you found this information, did you 

find the actual files in this part of the computer? 

A. No, sir. 

Q. So what exactly did this information convey or 

what did it tell you when you saw this information in the 
unallocated space? 

A. I'm seeing what appears to be these file names 

in conjunction with URL, indicating in conjunction with 
what appears to be an upload URL. Also, there was a 
series of these in conjunction with one another also 
indicating what appear to be dates and times . And 
finally at the end of that the phrase upload complete. 

Q. Now, when you say there was a series of them, 

were they separated into different parts? 

A. It appeared to be a segmented RAR file. What 

that means is an RAR file that had been broken up into 
several smaller pieces and what we ' re seeing here is the 
upload of each segment . 
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Q. Mr. Johnson, I want to shift gears for a 

moment . One of the charges in this case involves a theft 
of a global address list. Did you find anything related 
to emails or global address lists in your review of this 
computer? 

A. I did. 

Q. And what did you find? 

A. Two specific references of relevance. 

Q. What was the first one? 

A. The first one appeared to be, I would classify 

as a tasker indicating someone requesting that the global 
address list be exfiltrated. 

Q. I'm retrieving what's been marked as 

prosecution exhibit 122 for identification. 

Mr. Johnson, I'm handing you what's been 
marked as prosecution exhibit 122 for identification. Do 
you recognize that image? 

A. I do. 

Q. And what is it? 

A. This is the contents of the unallocated space 

of the tasker I discovered. 
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Q. And is that the entirety of the tasker that 

you found? 

A. It seems to be cut off. I don't recall if 

there was any more at the bottom of this, sir. 

Q. If there was more in the tasker would you have 

included it in your screen shot? 

A. Yes, sir. 

MR. MORROW: Permission to publish, Your 

Honor . 

THE COURT: Go ahead. 
BY MR. MORROW: 

Q. Where was this information found again? 

A. Unallocated, sir. 

Q. And how did you find it in the unallocated 

space? 

A. In this case we just stumbled upon it during 

our examination finding it in other things. 

MR. MORROW: Your Honor, the prosecution 
moves to admit prosecution exhibit 122 for identification 
into evidence . 

MR. TOOMAN: No objection. 
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THE COURT: Thank you. Prosecution exhibit 
122 is admitted. 
BY MR. MORROW: 

Q. Mr. Johnson, what was the — you mentioned 

there were two things you found that were of interest . 
What was the second thing? 

A. The second thing was a large number of what 

appear to be exchange formatted email addresses. 

Q. And what do you mean by exchange formatted 

email address. What is exchange? 

A. Exchange is the Microsoft platform for email 

servers and infrastructure of email . 

Q. And you said these were email addresses? 

A. Yes, sir. 

Q. Approximately how many email addresses did you 



find? 



A 

Q 
A 

Q 
A 



A large number, sir, in the thousands. 
In the thousands? 
Yes, sir. 

Now, where was this found in the computer? 
Unallocated, sir. 
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Q. Mr. Johnson, it appears that a lot of the 

information that you found was in the unallocated space . 
Did you find any evidence of this computer being wiped at 
any time? 

A. Yes, sir. 

Q. And where did you find that evidence? 

A. As noted earlier, the first was, it was wiped 

during the installation process. Also, we identified 
that free space had been wiped on a couple of occasions . 

Q. And what do you mean by free space? 

A. Free space is the unallocated clusters. 

Q. And where did you find that evidence? 

A. The disk utility log. 

Q. And what is a disk utility log? 

A. A disk utility log is a log file, again, 

maintained by the operating system in conjunction with 
the use of the disk utility program. 

Q. And is that log created by a user or is it 

created by the computer? 

A. No. It's maintained by the system when they 

use a disk utility. 
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Q. I'm retrieving what's been marked as 

prosecution exhibit 125 for identification. 

Mr. Johnson, I'm handing you what's been 
marked as prosecution exhibit 125 for identification. 

A. Okay, sir. 

Q. Do you recognize that document? 

A. I do. 

Q. And what is it? 

A. This is the contents of the disk utility log 

obtained from PFC Manning ' s computer . 

Q. And how was that document created? 

A. This was exported from the disk image prior to 

my examination on the system. 

Q. Where on the log can you point me to that the 

free space was wiped? 

A. In this log file you will see a number of 

indications . See if I can find it . 

Q. I believe it would be towards the front. 

A. Yeah. Here we are. Where you see secure free 

space being first, in this case, being stopped. 

Q. Stop you for a moment. Permission to publish. 
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THE COURT: Go ahead. 
Q. I'm going to publish page two. 

Can you point out the line, Mr. Johnson, that 
indicates that the free space was wiped? 

A. There are two. The first one you see in line 

67 starts the process of running the secure erase free 
space for unallocated clusters. This one was canceled, 
it stopped. 

Q. And why was it canceled? 

A. My experience would be it was canceled because 

MR. TOOMAN: Objection. 
THE COURT: Yes. 

MR. TOOMAN: This witness would not be able 
to testify as to why, Your Honor, this particular process 
was canceled. 

THE COURT: You're talking about line 67? 

THE WITNESS: That's the start, ma'am. It's 
a block. It completes at line 7 6 in this block. 

THE COURT : Why don ' t you ask some additional 
foundation questions? 
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BY MR. MORROW: 

Q. Mr. Johnson, I'll refer you to line 70. What 

does that line indicate to you? 

A. It indicates the option is usually a 35 pass 

erase option. There are several options with a secure 
erase . 

Q. Now, what does a 35 pass erase option mean? 

A. 35 passes means the operating system will 

literally wipe the drive 35 times . 

Q. And that's an option that you can select when 

you ' re choosing to — 

A. Yes, sir. There are several options, 35 pass 

being one of them. 

Q. Now, I'll refer you to line 74. Can you 

explain what's conveyed by that line? 

A. It indicates that it was stopped in 43 seconds 

indicating it was likely canceled because it would not 
have completed in 43 seconds. 

Q. And how long, in your experience, how long 

does a 35 pass erase take? 

A. It will depend on the size of the drive, but 
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many, many hours, even days in some cases. 

Q. And now I'll refer you to line 79. What does 

that line convey? 

A. This indicates a seven pass free space erase, 

another option available. 

Q. And again, what would the computer do with a 

seven pass erase? 

A. It will erase seven times versus 35. 

And what was the result of that seven pass 



Q. 
erase? 
A 

Q 
A 

Q 
A 

Q 



This pass did complete. 
And how do you know that? 
It's indicated in line 85. 
Line 85? 

Yes, sir. Or line 85 or line 86. 
And how long did it take for the computer to 
complete the seven pass erase? 

A. Three hours and 4 8 minutes. 

MR. MORROW: Your Honor, the prosecution 
moves to admit prosecution exhibit 125 for identification 
into evidence . 
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MR. TOOMAN: No objection, ma'am. 
THE COURT: Can I see it, please? 
Prosecution exhibit 125 for identification is 

admitted. 

BY MR. MORROW: 

Q. Now, Mr. Johnson, based on what you reviewed 

in the install log and what you've reviewed in the disk 
utility log, what can you say about what will be able to 
be recovered from this computer? 

A. All we can say is all of the allocated files 

in this system have been created subsequent to its 
installation on January 25. However, all of the 
unallocated is after the last free space wipe on January 
31. 

Q. So what are the pertinent dates in terms of 

the information that can be recovered on the computer? 

A. Nothing can be recovered prior to 25 January, 

nothing in unallocated space can be prior to 31 January. 

MR. MORROW: Thank you, Mr. Johnson. 
MR. TOOMAN: Ma'am, the defense requests a 
ten minute comfort break before we have cross 
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examination . 

THE COURT: Any objection? 
MR. FEIN: No, ma'am. 
(BRIEF RECESS . ) 

THE COURT: Let the record reflect all the 
parties present when the court recessed are again 
present. The witness is on the witness stand. 

Anything we need to address? 

MR. FEIN: Yes, ma'am. Quickly an 
administrative note. At the start of today's session, 
Your Honor, there were 12 members of the media in the 
media operations center, one stenographer, and the public 
affairs office will be able to accommodate the hot spot 
being with the stenographer starting today. Also, the 
overflow trailer as of the end of this previous recess or 
at the end of the session, going into the recess, was not 
being used. The spectator area in the court-martial 
presently is not at full capacity. 

THE COURT: Thank you. Cross examination. 
CROSS EXAMINATION BY MR. TOOMAN: 
Q. Good morning, Mr. Johnson. 
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A. Good morning. 

Q. Mr. Johnson, I want to start just by talking a 

little bit about your process when you 1 re doing a 
forensic analysis. When you do that analysis you're 
looking for clues and leads, correct? 

A. Yes, sir. 

Q. And ultimately, after your analysis is over, 

you're going to create a report? 
A. Yes, sir. 

Q . And anything that ' s important you ' re going to 

note in that report, correct? 
A. Yes, sir. 

Q. I want to talk about the chats that you 

discussed on direct examination along with, between PFC 
Manning and pressassociation . 

A. Okay, sir. 

Q. You went through those chats line by line, 

correct? 

A. I believe so, sir. 

Q. Read them in their entirety? 

A. Yes, sir. 
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Q . You were looking for leads and clues within 

t hat do cument ? 

A. Yes, sir. 

Q. You would agree with me that anywhere in that 

document is PFC Manning ever asked to send anything to 
pressassociation? 

A. I don't recall, sir. I don't believe so. 

Q. You don't recall as in he wasn't asked or 

you're not sure? 

A. I'm not sure, sir. I don't recall specifics. 

Q. I'll retrieve prosecution exhibit 123. 

Hand this to the witness. I know it's 
lengthy, Mr. Johnson, but I'll ask you to look through 
the entire chat and let me know if you see any instance 
where pressassociation asks PFC Manning to send them 
something . 

And we would ask the government if they are 
willing to stipulate to this to speed this along without 
having Mr . Johnson need to read through the entire chat . 

MR. MORROW: No, Your Honor. 

THE COURT : All right . The government ' s not 
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willing . 

A. No, sir, I don't see anything that would 

appear to be a direct request . 

Q. Okay. Thank you. 

You would also agree with me, now that you've 
reviewed the entire document, that at no point is PFC 
Manning asked by pressassociation, hey, do you have 
access to this, or do you have access to that? 

A. I don't see any direct knowledge of that, sir, 

no . 

Q. So they never asked him, hey, Brad, could you 

get us this thing? 

A. No, sir. 

Q. There's no discussion in that chat of a most 

wanted list, is there? 
A. No, sir. 

Q. There's no reference to that at all either by 

pressassociation? 

A. No, sir, I don't believe so. 

Q. And my client never references a most wanted 

list? 
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A. No, sir. 

Q. Now, PFC Manning and pressassociation do talk 

about a number of classified documents in those chats, 
correct? 

A. Yes, sir. 

Q. They talk about the Iraq and Afghanistan 

databases? 

A. The CIDNE databases, yes, sir. 

Q. And through your forensic examination you 

determined that PFC Manning gave those SigActs, the 
contents of those databases, to WikiLeaks around 3 
February, is that correct? 

A. Could you be more specific, sir? 

Q. Sure. Over the course of your forensic 

examination you all were able to determine when PFC 
Manning gave certain items to WikiLeaks, correct? 

A. I have evidence that information was sent, not 

specific information. 

Q. Okay. Did you have any evidence that the 

CIDNE databases or the contents of the CIDNE databases 
were sent from PFC Manning to WikiLeaks? 
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A. I don't recall — can you be more specific, 

specifically what you're asking for? 

Q. Sure. One of the charges against my client is 

that he downloaded the SigActs from both the Iraq and the 
Afghanistan CIDNE databases and then provided those 
documents to WikiLeaks . 

A. Correct. 

Q. Did your forensic examination uncover any 

evidence of PFC Manning actually getting those things? 

A. I don't have the contents of information to 

verify whether it was CIDNE or not . 

Q. Okay. Is there any evidence of PFC Manning 

getting SigActs, regardless of where they came from? 

A. The same thing, sir. I don't have contents to 

say whether it was a SigAct or anything else . 

Q. Okay. Do you have any forensic evidence that 

he gave a file called Iraq events or a file titled 
similarly? 

A. No, sir. 

Q. Okay. Did you have any forensic evidence of 

him having sent a cable having to do with Iceland to 
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WikiLeaks? 

A. No, sir, beyond the discussion in the chat. 

Q. Only the discussion in the chat. Okay. And 

what about Guantanamo Bay detainee assessment briefs? 

A. Again, sir, beyond the chat, no direct 

contact . 

Q. Okay. So in that chat my client talked about 

the SigActs, he talked about a single Department of State 
cable, correct? 

A. Specifically the one, yes, sir. 

Q. Reykjavik? 

A. Yes, sir. 

Q. And he also talked about detainee assessment 

briefs . 

MR. MORROW: Objection, Your Honor. The 
chats are not the SigActs . 

THE COURT: Captain Tooman. 

MR. TOOMAN: Mr. Johnson did the — 

THE WITNESS: I don't recall the word SigAct 
being in this contact, sir. 
BY MR. TOOMAN: 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 

61 

Q. Do they talk about the war logs? 

A. Not by that term, no, sir. 

Q. What classified information is referenced in 

the chats? I believe you testified on direct that there 
was a reference to Iraq and Afghanistan. 

A. Yes, sir. 

Q. What was that reference? 

A. I'd have to refer to specifics, sir. 

Q. Please do. 

A. Sir, we have arrest information related to 

Tigris or Tigris, that would be in that area. 
Q . Okay . 

A. Specifically, sir, we have other references to 

Afghanistan. I'm not sure specifically what you're 
looking for. 

Q. Okay. So there are no references to the 

SigActs in those chats? 

A. There's no reference to that term, sir. 

Q. Okay. Is there any reference to the Farah 

video in those chats? 

A. I don't recall. 
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No, sir, I don't believe so. 
Q. Is there any reference to the Granahi air 

strike in that chats? Same thing, two different names. 

A. I don't recall that being in here, sir. I can 

review it . 

Q. Please do. 

THE COURT: Captain Tooman, is this going to 
have a point? I can read the chats. 

MR. TOOMAN: Yes, ma'am, the point is that 
they're not in there, and we've also asked Mr. Johnson 
what the dates are of those chats. 

THE WITNESS: They are in March 2010. 
BY MR. TOOMAN: 

Q. Specifically, what's the range, is the range 

of 5 March to 18 March? 

A. 5 March to — did we have 18 March? Yes, sir. 

MR. TOOMAN: I'll retrieve that exhibit. 
(INAUDIBLE) . 
THE WITNESS: No, sir. 

MR. TOOMAN: I'll retrieve prosecution 

exhibit 123. 
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BY MR. TOOMAN: 



Q. Now, you spoke on direct about volume mounting 

data, correct? 

A. Uh-huh. Yes, sir. 

Q . And that ' s evidence of a CD being burned? 

A. CD, other removable, some media of some sort. 

Q. So it could be a flash drive? 

A. It could be, yes, sir. 

Q. A SD card? 

A. Yes, sir. 

Q. External hard drive? 

A. Yes, sir. 

Q. In some fashion, data is being transferred 

from the Macintosh to another medium? 
A. Yes, sir. 

Q. We'd retrieve prosecution exhibit 127, please. 

Permission to publish, ma'am? 

THE COURT: Go ahead. 
Q. Mr. Johnson, can you see that okay? 

A. Yes, sir. 

Q. I'd like to focus your attention on line 49. 
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What does that line tell you? 

A. That would indicate that a file potentially 

named Far ah dot zip may have come from a volume attached 
to this machine using the name of 100411 underscore 918 
or, excuse me, 0918 — 0918. 

Q. Okay. And what the name of that volume 

suggests is that that file, Farah dot zip, was put on 
another medium on April 11, 2010, correct? 

A. April 11? Yes, sir. 

Q. And at 0918 in the morning? 

A. Yes, sir. Depending on the timeframe. 

Q. Now, you're not able to tell what is actually 

in that file, can you? 

A. No, sir. 

Q. You were unable to recover that? 

A. No, sir, we were not. 

Q. What is a zip file, Mr. Johnson? 

A. A zip is an archive, compressed or an 

archiving function . 

Q. Typically why would one use that sort of file? 

A. To have additional files, to consolidate one 
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file or multiple into a single file that can be easily 
moved around, transferred, stored. 

Q. Okay. And you would agree with me, I think, 

that another use of a zip file is to compress? If you 
have big files, you can compress them into one using the 
zip function, correct? 

A. Yes, sir. 

Q. So you would agree with me that it's possible 

that inside that file are documents that take up a lot of 
space? 

A. Yes, sir. 

Q. Or files that take up a lot of space? 

A. Yes, sir. 

Q. Removing prosecution exhibit 127 from the 

projector and returning it to court reporter. 

I'd like to retrieve prosecution exhibit 41. 
Permission to publish, ma'am? 
THE COURT: Proceed. 
Q. You spoke about this email on direct. This is 

an email between my client and a person named Eric 
Schmiedel, correct? 
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A. Yes, sir. 

Q. Now, within this video there's classified 

information that 1 s discussed? 

A. I'm sorry. Within the video? 

Q. I'm sorry. Within this email. 

A. I couldn't tell you whether the content of 

this email is classified. 

Q. Okay. Does it reference what you understand 

to be classified material? 

A. State department cables, yes, sir. 

Q. It also references an entire database of 

events for the Iraq war? 

A. Yes, sir. 

Q. So that would be the SigActs, is that what you 

understand that to be? 

A. I don't know what those incident reports are, 

sir . 

Q. Okay. It also talked about the Apache video, 

is that correct, collateral murder? 
A. Yes, sir. 

Q . Move it up here a little bit . 
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A. Sorry, sir. The screen's a little blurry. 

Yes, sir. Down in section three. 
Q. Down in section three there's discussion of 

the Apache video? 

A. Yes, sir. Well, collateral murder. 

Q. Collateral murder? 

A. Yes, sir. 

Q. Do you understand those videos to be the same 

thing? 

A. Yes, sir. 

Q. I've removed the email from the overhead. 

Mr. Johnson, you'd agree with me there's no 
other documents or videos referenced in that email, 
correct? 

A. I don't recall seeing anything else in there, 

sir . 

Q. Okay. I'm going to hand this to the witness. 

Mr. Johnson, is there any reference to a 
Farah video in that email? 
A. No, sir. 

Q. What are the dates of that email chain? 
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A. Can you be more specific, sir? 

Q. Sure. My understanding of that document is 

it ' s a chain of emails between PFC Manning and Eric 
Schmiedel . When was the first email sent? 

A. May 19. 

Q. And when was the last email sent, the most 

recent one? 

A. May 20. 

Q. Thank you, Mr. Johnson. 

Mr. Johnson, you spoke in your examination of 
the unallocated clusters, correct? 
A. Yes, sir. 

Q. And what we understand the unallocated 

clusters to be are basically that's where, when you 
delete something, that's where it goes? 

A. Where it remains, yes, sir. 

Q. And it would remain there until it was 

overwritten, correct? 

A. That's correct. 

Q. And if it's overwritten, then it's pretty much 

gone forever? 
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A. Not pretty much, sir. It is gone. 

Q. It is gone. Okay. 

Now, within the unallocated clusters, you 
can't associate a date with something, correct? 
A. Not directly, sir, no. 

Q. So you don't know when the file was deleted? 

A. No, sir. 

Q. Can't associate a time either? 

A. No, sir. 

Q. All you know is that this file is now in the 

unallocated clusters? 

A. The contents are, yes, sir. 

Q . Sorry . 

A. The content. It may be a fragment of a file. 

Q. Okay. So it could be a partial file? 

A. Correct. 

Q. So, for example, if it were a picture, you 

might only see half a picture? 
A. Correct. 

Q. Now, when you were searching the unallocated 



clusters, you were again searching for any sort of clues, 
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correct? 

A. Yes, sir. 

Q. And one of the things you were searching for 

were any references to WikiLeaks? 
A. Sure. 

Q. Because WikiLeaks was implicated in this 

investigation, you wanted to find every instance where 
WikiLeaks was talked about? 

A. Sure. 

Q. Okay. You found several, didn't you? 

A. Yes, sir. 

Q. You found over a hundred instances of the 

WikiLeaks page in the unallocated clusters? 

A. I'd have to refer to my report. It sounds 

reasonable . 

Q. Okay. You found some JPEGs, a JPEG being a 

picture file? 

A. Yes, sir, (INAUDIBLE) . Yes, sir. 

Q. You didn't find any evidence of what's known 

as a WikiLeaks most wanted list in the unallocated 
clusters, did you? 
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A. No, sir. 

Q. And you didn't find that in the allocated 

clusters either? 

A. No, sir. 

Q. So on PFC Manning's computer, whether in the 

allocated space or in the unallocated space, no reference 
to the WikiLeaks most wanted list? 

A. No, sir. 

Q . That ' s something you certainly would have 

noted had you found it? 
A. Yes, sir. 

Q. You also were able to look at or recover other 

websites that PFC Manning would have visited? 
A. Yes, sir. 

Q. None of those websites were associated with 

terrorism? 

A. No, sir. 

Q. They weren't associated with a hatred of 

America or anti— American beliefs? 
A. No, sir. 

Q. Now, sitting in the unallocated clusters you 
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found several references to the WikiLeaks submission 
page, correct? 

A. Yes, sir. 

Q. And, again, you can't associate a date or a 

time with those pages, is that correct? 

A. I cannot determine the dates and times of the 

page we have fragments. However, there do appear to be 
dates and times in the vicinity of those that appear to 
be possibly content on that page . 

Q . Sure . So you don ' t know when that page ended 

up in the unallocated clusters, but when you look at the 
page itself there are some clues? 

A. There are clues. 

Q. To the date? 

A. Yes, sir. 

Q. And on the submission page you see what 

appears to be submissions by PFC Manning to the WikiLeaks 
web page on a couple different dates, correct? 

A. I believe so, sir. I'd have to verify that. 

Q. Okay. One of those days was the 11th of 

April, 2010? 
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A. 



I don't remember specific dates, sir. It 



sounds reasonable . 



Q. 



Is that about what you remember? 



A. 



It was April, sir. 



Again, that sounds right, 



but I don't remember specifically. I need to refer. 



MR. TOOMAN: Your Honor, Mr. Johnson's report 



is, his report of PFC Manning's Macintosh computer is a 
classified document. It hasn't been marked. We have it 
here. If we could take a brief recess we can get that 
document, have it marked so Mr. Johnson can refer to it. 



THE COURT: In the panel box? 
MR. TOOMAN: Yes, ma'am. Of course. 

THE COURT: How long do you need? 
MR. TOOMAN: Five minutes. 

THE COURT: All right. Why don't we make it 



the regular ten. We'll reconvene at 11:15. 
(BRIEF RECESS . ) 

THE COURT: Let the record reflect all 
parties present when the court recessed are again present 
in court. The witness is in the witness box. 



Q. 



Okay . Just a moment , please . 
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Captain Tooman, are you ready? 

MR. TOOMAN: Yes, ma'am. For the record, Mr. 
Johnson has defendant 1 s exhibit Juliette for 
identification . 

THE COURT: I thought you were getting a 
different exhibit . Juliette is what you were 
referencing? 

MR. TOOMAN: Yes, ma'am. 
BY MR. TOOMAN: 

Q. Mr. Johnson, if you could please take a look 

at that exhibit and just tell us what it is . 
A. This is a copy of my forensic — 

THE COURT: Okay. Now you're sitting way far 
away from me and I'm going to have a real difficult time 
hearing you. 

THE WITNESS : Sorry . 

THE COURT: Can you say what that was again? 

THE WITNESS : This is a copy of my forensic 
report from his Mac computer. 

THE COURT: Thank you. 
BY MR. TOOMAN: 
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Q. How do you know that that's your forensic 

report? 

A. It is on our structure, it has my signature 

copy attached to it . It appears to be complete . 

Q. How did you go about creating that report, Mr. 

Johnson? 

A. I'm sorry, sir. Could you be more specific? 

Q. Sure. What was the process you followed when 

you created that report? 

A. It was derived during the course of my 

investigation. It includes findings and is ultimately a 
word document converted into a WPDF format . 

Q. Now, Agent Johnson, does that document, I 

asked you a question before we recessed, about 
submissions to WikiLeaks . 

A. Yes, sir. 

Q. And would you agree with me that there was 

evidence in unallocated clusters of a submission to 
WikiLeaks on 11 April 2010? 

A. I'll refer to the report, sir, for the date. 

Q . Okay . 
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A. That would be April 10, 2010, sir. 

Q. Okay. So submission, what appears to be a 

submission to WikiLeaks on April 10? 
A. Yes, sir. 

Q. Are there any other days where there appear to 

be submissions to WikiLeaks in April 2010? 
A. April 11. 

Q . Okay . 

A. And April 12 . 

Q. Okay. Are there any other, did you recover 

any other evidence in the unallocated clusters of 
WikiLeaks submissions? 

A. I don't believe so, sir, no. 

Q. You can head back to the witness stand. I've 

retrieved the exhibit . 

THE COURT: That's defendant's exhibit 
Juliette for identification, right? 

MR. TOOMAN: Yes. And actually we would 
offer this as defendant's exhibit Juliette in the record. 

MR . MORROW : Ob j ect ion . 

THE COURT: What's your objection? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 



77 

MR . MORROW : Hearsay . 

MR. TOOMAN: These are the statements of the 
witness . He authenticated it . 

MR. MORROW: They would be out of court 
statements offered to prove the truth of the matter 
asserted. 

THE COURT: All right. Sustained. 

MR. TOOMAN: Would offer it under 803.6, 
created in the ordinary course of Mr . Johnson ' s business . 

THE COURT : Government . 

MR. MORROW: One moment, Your Honor. 

Your Honor, I don't believe the defense has 
laid a foundation for the business record exception. 

THE COURT: Well, that's true. Want to 
continue on with this witness? 

MR. TOOMAN: Yes, ma'am. 
BY MR. TOOMAN: 

Q. Mr. Johnson, can you explain for the court 

what that document was and why it was created? 

A. It's the forensic report that I developed 

during the course of my investigation. 
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Q . How many of those would you say you 1 ve created 

in your career? 



A. 


I do not know, sir. A 


number . 


Q. 


Would it be a lot? 




A. 


A fair number, sir. 




Q. 


Hundreds ? 




A. 


Probably not, sir. 




Q. 


Is that something that 


you create every time 



you do a forensic examination of a computer or some piece 
of digital media? 

A. Not necessarily, sir, no. 

Q. Okay. Did you do that as part of your duties 

with respect to this investigation? 

A. Yes, sir. 

MR. TOOMAN: One moment, please. 

Q. Mr. Johnson, are you required to make that 

report as part of your — as part of this investigation? 

A. Yes, sir. 

Q. What did you do with it once you created it? 

Where did you store it? 

A. Could you be more specific, sir? 
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Q. How did you store that document once you 

created it? 

A. It ' s a digital document stored on our closed 

and classified systems. 

Q. Is that what you all do with every forensic 

examination report that you create? 

A. Yes, they would be on the appropriate systems. 

MR. TOOMAN: Your Honor, we would re-offer 
defendant ' s exhibit Juliette under the business records . 

THE COURT : May I see defendant ' s exhibit 

Juliette? 

MR. TOOMAN: Yes, ma'am. 

THE COURT: Is this report exclusively your 
examination of that computer? Did you talk to anybody 
else? Is there, are there any statements from other 
people in this report? 

THE WITNESS: Yes, ma'am. 

THE COURT: There are statements from other 
people in this report . 

THE WITNESS: Statements, ma'am? 

THE COURT: Did you interview anybody? 
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THE WITNESS: No, sir. No, ma'am. Pardon 

me . 

THE COURT : Government . 
MR. FEIN: Ma'am, if I may. 
THE COURT: Yes. 

MR. FEIN: A few issues, Your Honor. First, 
under 803.6, this document clearly was created 
specifically for this court-martial, not necessarily in 
the regularly conducted business of Mr. Johnson. It's 
also cumulative with his testimony. 

If the defense counsel wants to refresh his 
recollection or use this as past recollection recorded, 
the witness can testify off of the document, but not in 
lieu of or the document substituting for the actual 
in-court testimony and then while they ' re here . So it ' s 
not only hearsay, not falling under 803.6, but it's also 
cumulative to his testimony of an in-court witness . 

THE COURT: All right. Well, the cumulative 
I'm going to overrule. 

The MRE 803.6, is this a forensic laboratory 

report? 
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THE WITNESS: Yes, ma'am, you could treat it 
as that, yes, sir. Yes, ma'am. 

THE COURT : Government . 

MR. FEIN: Yes, ma'am. Although it is a 
forensic laboratory report, again, it was made solely for 
the purposes of this litigation. 

THE COURT: I'm going to overrule the 
objection. It's made as part of the regular course, 
regularly conducted business activity of this entity. 
Defendant's exhibit Juliette is admitted. 
BY MR. TOOMAN: 

Q. Mr. Johnson, were you able to tell — again, 

we ' re still talking about the WikiLeaks submissions from 
the unallocated clusters . Were you able to tell if those 
submissions were successful? Was the submission 
completed? 

A. There's no mention of the words upload 

complete that I would interpret as a success . 

Q. Was there any evidence that WikiLeaks actually 

got it? 

A. I couldn't say, sir. That would not be 
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available on this computer. 

Q. In the course of your investigation, did you 

uncover any evidence of WikiLeaks releasing anything 
related to Farah? 

A . I did not , no . 

Q. Now, you also did a search for, on the 

computer for Farah, correct? 

A. Yes, sir, I believe so. 

Q. And you found several files, again, in the 

unallocated clusters, and they were in the location users 
slash BManning slash desktop slash Farah slash Farah. 

A. That was references to it. I don't believe 

those were actual files we found. 

Q. What was in there? 

A. I don't recall, sir. I don't recall the 

specific names, sir. 

Q. Okay. I'm going to hand the witness 

defendant's exhibit Juliette. If you would please move 
to the panel box. 

MR. FEIN: Your Honor, objection. If it's 
already admitted, this would be cumulative. 
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THE COURT: Major Fein, the government has 
been doing that throughout the trial . 

MR. FEIN: Yes, ma'am. 
BY MR. TOOMAN: 

Q. I believe this would be on the same page you 

were just looking at, Mr. Johnson. 

A. Thank you, sir. Which I have to find again. 

Q. I believe it's page 67 or page 66. 

A. Thank you, sir. 

Can you repeat your question, sir? 

Q. Sure. You would agree with me that you found 

references to Farah in a location that was users slash 
BManning slash desktop slash Farah slash Farah? 

A. The slash Farah, sir, the rest of that is the 

file name. Users slash BManning slash desktop slash 
Farah . 

Q. Okay. Just one Farah in that location? 

A. Yes, sir. 

Q. And in that file you found seven files titled 

Farah, correct? 

A. Yes, sir, I believe so. 
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Q. And they were titled Farah dot part one and 

then they all have that name, correct, with the — 
A. That's correct. 

Q. So Farah dot part 1 through part 7? 

A. Yes, sir. With dot RAR on the end of it. 

Q. With dot RAR. Okay. 

And you don 1 1 know when those documents 
arrived in that location, do you? 
A. No, sir. 

Q. But you could say that those documents got 

there after 31 January, correct? 

A. In reference to these documents, yes, sir. 

Q. Well, the unallocated space was wiped on 31 

January, correct? 

A. Yes, sir. 

Q. So anything that is in the unallocated 

clusters must have arrived there after 31 January, right? 
A. Yes, sir. 

Q. Now, you also found several documents related 

to Farah that in your examination were identical to files 
found on CENTCOM servers, correct? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 



85 



A. Could you be more specific, sir? 

Q. Sure. You found 54 pictures. And before you 

refer to the document, if you can answer from your 
memory, and if not, then refer to the document. Do you 
recall finding 54 pictures in the unallocated space that 
had identical hash values as pictures found on the 
CENTCOM server? 

A. Yes, sir, I believe so. 

Q. You also found one video that has the 

identical hash value to a video found on the Farah 
server, correct? 

A. I believe so. I don't recall, sir. 

Q. Okay. Well, please look and verify that. 

A. Yes, sir. 

THE COURT: What was the question again, the 
last question? 

Q. Yes, ma'am. 

Mr. Johnson, in the unallocated clusters you 
found a video that had the same hash value as a video 
that you found on the CENTCOM server, correct? 

A. They were contained within a recovered RAR 
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file, yes, sir. 

Q. And that recovered RAR file was associated 

with Farah, correct? 

A. Yes, sir. 

Q. Okay. So you would assume that that video 

file has something to do with Farah? 
A. Yes, sir. 

Q. Particularly since the hash value of the video 

on PFC Manning's computer matched the hash value of a 
video that you found within the Farah folders on the 
CENTCOM servers? 

A. Agent Shaver found all the files on CENTCOM. 

We compared them. 

Q. And you didn't make note of the actual file 

type, did you? 

A. File type? No, sir. 

Q. Just it's a video file? 

A. A video file, yes, sir. 

Q . And you agree with me that there are multiple 

types of formats that video files could be in, correct? 
A. Yes, sir. 
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Q. There's WMV, that's a type of movie file? 

A. Yes, sir. 

Q. What are some other ones? 

A. MP4, DVI . There's a large number, sir. 

Q. And you all didn't know what type of file it 

was? 

A. No, sir, I did not. 

Q. And you didn't make a note of the file name on 

the Farah server that the file on PFC Manning's computer 
matched, correct? 

A. No, sir, I did not. 

Q. Just one of the videos on the CENTCOM server 

matched a video in PFC Manning's unallocated clusters? 
A. Yes, sir. 

Q. So we don't know what video that is? 

A. No, sir, I do not recall. 

Q. But you would agree with me that that video 

must have arrived in the unallocated clusters after 31 
January? 

A. Yes, they were filed in there after 31 

January . 
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Q. And you didn't find any references to the 

Farah video in the allocated clusters? 

A. No, sir, I don't believe so. 

Q. Okay. I'm going to retrieve defendant's 



exhibit Juliette. And Mr. Johnson, can you retake the 
witness chair? 

Mr. Johnson, throughout your investigation 
you talked about you looked at everything on PFC 



Manning's computer, right? 

A. Define everything, sir. 

Q. You looked at every bit and byte on that 

computer, and you looked at it for evidence? 

A. I've looked at the contents, sir. I can't say 

we ' ve examined every bit and byte . 

Q. Okay. Well, you had a forensic image of it 

which is an exact copy, correct? 

A. Yes, sir. 

Q. And within that exact copy you conducted 

searches? 

A. Yes, sir. 

Q. And those searches looked at the entire 
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computer? 
A. 

Q. 
A. 

Q. 

correct? 
A. 

Q. 
A. 

Q. 



Yes, sir. 

The allocated space and the unallocated space? 
Yes, sir. 

That included chats which we've talked about, 



Yes, sir. 

That included emails? 
Yes, sir. 

You saw no references on PFC Manning ' s 
personal Macintosh to Jason Katz, did you? 

A. No, sir, I did not identify Katz. 

Q. There were no emails between PFC Manning and 

an individual named Jason Katz? 

A. No, sir, I don't believe so. 

Q. No chats? 

A. No, sir. 

Q. No websites that you associated with Jason 

A. No, sir. 

Q. No connection whatsoever between PFC Manning 



Katz? 
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and Jason Katz? 

A. Not that I identified, sir. 

Q. Okay. You also didn't find any financial 

transactions that would have suggested to you that PFC 
Manning was paid for anything he gave to WikiLeaks? 

A. No, sir. 

Q. There were no large sums of money that were 

transferred to PFC Manning? 
A. No, sir. 

Q. You spoke on direct about the global address 

list, correct? 

A. Yes, sir. 

Q. I want to retrieve prosecution exhibit 122, 

please . 

Ma'am, permission to publish. 

THE COURT: Go ahead. 
Q. Now, Mr. Johnson, you testified that this was 

what you would call a tasker, correct? 
A. Yes, sir. 

Q. Could you tell what format this document was 

in? 
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A. It's raw text, sir. 

Q. A text file. So that would have been 

something — could you tell how it got on the computer? 
A. No, sir. 

Q. But this is the sort of thing, so there's no 

evidence that would suggest someone sent this to PFC 
Manning? 

A. I cannot determine that, sir. 

Q . Okay . So you would agree with me that it ' s 

quite possible that this is a document PFC Manning 
created himself? 

A. It's possible, sir. 

Q. And are you familiar with the format of that 

document? 

A. Can you be more specific, sir? 

Q. Does that look like a military sort of format 

for a document? 

A. It looks to me to be similar, yes, I'll say 

similar . 

Q. Okay. Now, you would agree with me that the 

objective portion of this is blank? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 

92 



A. 


Yes, sir. 


Q. 


It doesn't say send to WikiLeaks? 


A. 


No, sir. 


Q. 


It doesn't say anything? 


A. 


Doesn't say anything. 


Q. 


Returning prosecution exhibit 122 . 



Now, we talked about the WikiLeaks submission 
pages and the only WikiLeaks submission pages you found 
had to do with Farah, correct? 

A. With the Farah dot RAR files, yes, sir. 

Q. Right. There were no WikiLeaks submission 

pages that suggested that PFC Manning sent something to 
WikiLeaks? 

A. No, sir. 

Q. And in fact, you found the global address list 

or what appeared to be the global address list in the 
unallocated clusters? 

A. Yes, sir. 

Q. And that means it was deleted? 

A. Yes, sir, deleted content. It's there 

somehow . 
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Q. Okay. It had to have been — is it possible 

to put something on unallocated clusters? 

A. Possible, but it would require extraordinary 

work . 

Q. Okay. In all likelihood it was something that 

was on the computer in the allocated space and then the 
user pushed delete? 

A. Yes, sir. 

Q. Okay. Now, you're a computer expert. Do you 

ever challenge yourself with things related to computers 
just to see if you can do it? 

A. Can you be specific? 

Q. Yeah. Have you ever just been at a computer 

and thought I wonder if I could do this, and then you 
tried to do it? 

A. Yes, sir. 

Q. Are you aware that at the time the global 

address list was downloaded my client was no longer 
working as an intelligence analyst, he was working in a 
supply room? 

A. I'm not familiar with the timeframe on that, 
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sir . 

Q. Okay. Do you think it's possible that if PFC 

Manning were in a supply room he might — 

THE COURT: Overruled. I'm sorry. I mean 
sustained. No. That's speculation. 

Q. I'm going to continue talking a little bit 

about the GAL. You said it appeared to be a global 
address list, correct? 

A. Yes, sir. 

Q. You would agree with me that there is someone 

who controls the global address list? 
A. Can you specify, sir? 

Q . Sure . There would be someone within DOD who 

could tell you exactly who was on the global address 
list, correct? 

A. At some particular point in time, yes, sir. 

Q. Sure. You could go to someone and you could 

say, hey, as of June 11, what is the global address list? 

A. I don't know if they could give you a specific 

point in time, but yes. 

Q. Okay. Someone could print it out and say here 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/12/13 Morning Session 

95 

are the names that are the global address list? 
A. Yes, sir. 

Q. Okay. Did you all do that as part of your 

investigation, ask someone for the actual global address 
list? 

A. I do not, sir, that would be outside the scope 

of forensics. 

Q. So you all didn't compare the global address 

list that you found or what appeared to be a global 
address list in the unallocated space, you never compared 
that to an actual global address list? 

A. I did not, no, sir. 

Q. Okay. Mr. Johnson, would you agree with me 

that Iraq is a very challenging environment for 
electronics? 



A. 


Yes, sir. 


Q. 


It's very hot? 


A. 


Yes, sir. 


Q. 


Very dusty? 


A. 


Yes, sir. 


Q. 


Sandy? 
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A. Yes, sir. 

Q. It's difficult for a computer? 

A. Yes, sir. 

Q . So when one 1 s having computer problems 

something that they can do to alleviate those problems is 
to wipe the machine, correct, just start over? 

A. Can you be more specific, sir? 

Q. Sure. If you're having performance problems 

with your computer, one of the things that you could do 
would be I'm just going to wipe this, I'm going to start 
over? 

A. Sure. But that would not have anything to do 

with physical environment . 

Q. Okay. But it could correct some of the 

problems that your computer was having? 

A. Possibly, sir. 

Q. And there are a lot of reasons why people wipe 

their machines, correct? 
A. Yes, sir. 

Q. You testified that PFC Manning reinstalled his 

operating system on 25 January 2010? 
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A. Yes, sir. 

Q. He wiped the unallocated space or cleaned the 

unallocated space on 31 January 2010? 
A. Yes, sir. 

Q. Now, PFC Manning is charged with giving the 



Apache air strike video to WikiLeaks, he's charged with 
having done that between 15 February and April 5, 2010. 
Is there any evidence that PFC Manning wiped his computer 
in that time? 

A. I don't recall, sir. I don't believe so. 

Q. PFC Manning is charged with giving SigActs to 

WikiLeaks. Is there any evidence that he wiped his 
machine in February of 2010? 

A. Again, sir, I don't recall a specific date, 

but I don't believe there was anything, no. 

Q. Okay. He didn't wipe his machine in April 

2010? 

A. I don't recall. I'd need to refer to the log 

file, sir, but I don't recall being there, no. 

Q. I believe you testified that there was only 

one instance of him wiping unallocated space, right? 
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A. Yes. 

Q. And he didn't wipe it in April? 

A. Again, I have to refer to the log to confirm, 

but I don't recall, sir, no. 

Q. Could I have prosecution exhibit 125, please? 

Handing the exhibit to Mr . Johnson . 

Mr. Johnson, would you please review those 
logs and tell me if PFC Manning wiped his machine, if 
there ' s any evidence of PFC Manning wiping his machine in 
February of 2010? 

A. Yes, there is. 

Q. What did he do? 

A. He erased his machine on 2-11, 2010, free 

space . 

Q. And what's the free space? 

A. The unallocated clusters. I do stand 

corrected. 

THE COURT: What was the date of that? 
THE WITNESS: 2-11, ma'am. 
Q. Any other instances? 

A. However, sir, I will have to annotate that it 
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was stopped. 

Q. So it was not completed? 

A. That's correct. 

Q. Any other instances? 

A. No, sir. 

Q . Retrieve the exhibit . So the one in February 

was stopped, that means that nothing was wiped, correct? 

A. Only the first, whatever was wiped in the 

first two minutes, sir. 

Q. So two minutes. And I think you testified on 

direct that when PFC Manning did a wipe before it took 
almost four hours? 

A. Three hours, something, yes, sir. 

Q. 3 hours and 40 minutes? 

A. Roughly, sir, somewhere in that range. 

Q. How much gets wiped in two minutes? 

A. It will depend depending on the operating 

system, hard drive . Very little amount . 

Q . So there 1 s no evidence that PFC Manning wiped 

his computer in any other time in February? 

A. I did not observe any, no. 
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Q. Nothing in March? 

A. I did not observe any further entries in the 

log, sir. 

Q. So nothing in April? 

A. No, sir. 

Q. Nothing in May? 

A. No, sir. 

MR. TOOMAN: No further questions. Thank 
you, Mr. Johnson. 

THE COURT: Redirect. 

MR. MORROW: May we have a moment, Your 

Honor? 

THE COURT: Yes. 

MR. MORROW: Your Honor, may we have a ten 
minute recess, please? 

THE COURT: Yes, you may. Special Agent 
Johnson, once again, please don't discuss your testimony 
or knowledge of the case with anyone during the recess, 
okay? 

THE WITNESS: Yes, ma'am. 

THE COURT : Counsel , may I see you when we 
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recess the court for just a brief second? 



MR. FEIN: Yes, ma'am. 



THE COURT: 



Court is in recess. 



(BRIEF RECESS . ) 



THE COURT: 



Court is called to order. 



Let 



the record reflect all parties present when the court 
last recessed are again present in court . The witness is 
on the witness stand. Captain Morrow. 



And I want to begin by talking about something Captain 
Tooman referred to, a WikiLeaks most wanted list. 

I'm retrieving prosecution exhibit 109 for 
identification and prosecution exhibit 110. 

Permission to publish this, ma'am? 

THE COURT: Yes. 
BY MR. MORROW: 

Q. Let's start first with prosecution exhibit 109 

for identification. Mr. Johnson, I'd just like you to 
read the top of the page there. What does this say? 

A. I'm sorry, sir. That's slightly out of focus 



REDIRECT EXAMINATION BY MR. MORROW: 



Q. 



Mr. Johnson, I just have a couple questions. 
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for me . 



Q. 


Better? 


A. 


As good as it's going to get, sir. 


Q. 


Well — 


A. 


I can read that, sir. 


Q. 


Does that help? 


A 




Q. 


What does it say? 


A. 


What was the question again, sir? 


Q. 


Just read starting with the draft . 


A. 


Draft, the most wanted leaks of 2009, sort. 


Q. 


And at the very top of the page what ' s after 



sort? 

A. That heading line includes the word WikiLeaks . 

Q. And I'm going to move to the bottom of the 

page. Now, at the very bottom with TTP colon slash slash 
web. What does that, as an examiner, what does that mean 
when a page has sort of got that line of information at 
the bottom? What does that indicate to you? 

A. It would indicate to me that this was probably 

a printed page from a website and that bottom URL would 
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be the URL of the website being printed. 

Q. Okay. And now let's just go up and let's look 

at, do you see a box there, has a series of numbers, 23 
Sudan, 24, Syria? 

A. Yes, sir. 

Q. Do you see the United States up there? 

A. Yes, sir. 

Q. Okay. I'm going to flip to the section on the 

United States . 

MR. TOOMAN: Objection, Your Honor. 

Relevance . 

THE COURT: Where are you going with this? 

MR. MORROW: I'm going to a specific thing 
that's on this list that's discussed in the chat logs. 

THE COURT: Overruled. 
BY MR. MORROW: 

Q. Mr. Johnson, I'm showing you page nine of 

prosecution exhibit 109 for ID and beginning with the 
line open source dot gov, can you read just everything 
under there? 

A. From open source dot gov. We have brief, the 
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complete CIA open source center analytical database . The 
database is extensive, unclassified, non-public, but 
relatively accessible to certain outsiders after jumping 
through hoops. Despite its name, you need to be 
government official to gain access to it. 
Q . Keep going . 

A. Entity. Open source dot gov, and it provides 

a long URL there, sir. 

Q. Okay. Now I'm going to publish prosecution 

exhibit 110. And, again, I'm going to show page nine of 
that exhibit . And if you could read the open source dot 
gov section again, please. 

A. Open source dot gov. Brief, the complete CIA 

open source center analytical database. The database is 
extensive, unclassified, non-public, but relatively 
accessible to certain outsiders after jumping through 
hoops. Despite its name, you need to be government 
official to gain access to it . 

Q. Would you agree that the last two exhibits 

that that basically paragraph is basically the same? 

A. Yes, sir. 
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Q. Almost entirely the same? 

A. I'd have to look at them side by side, but it 

appears to be identical . 
Q . Okay . 

THE COURT: I'm going to stop you here for 
just a moment, Captain Morrow. Prosecution exhibit 109 
for identification is not admitted pending the motion 
that ' s at issue . 

MR. MORROW: I agree, Your Honor. 

THE COURT: So everything that you went 
through with the witness on an unadmitted document, 
should I not admit it, I'm going to disregard everything 
in prosecution exhibit 109 for identification. 

MR. MORROW: I understand, Your Honor. 
BY MR. MORROW: 

Q. I'm retrieving prosecution exhibit 123. And 

Mr. Johnson, I'm going to show you page five of this 
exhibit . 

One moment , Your Honor . 

I'm sorry. Took me a second to find it. 

Mr. Johnson, I'm showing you the top of page 
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five of prosecution exhibit 123. Can you read that? 
A. Yes, sir. 

Q. Okay. I want to start from basically the 

second line down where it says yeah. Can you read down? 

A. The following line, are you referring to just 

the message text, sir? 

Q. Yeah. Just identify the party who is saying 

it and then identify what's being said. 

A. Yes, sir. The next line. Pressassociation . 

Text reading WL action that were considered totally 
radical three years ago are now courted. 

Next line. Dog network. I told you before, 
government organizations can't control information. The 
harder they try, the more violently the information wants 
to get out . 

The following line. Pressassociation saying 
to 2500 articles in dot I S referendum in the past 15 
hours, despite it being a Sunday. 

Q. Let me stop you there. What does dot I S 

refer to? 

A. That would be a top level country level 
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domain, most, likely. 



Q. 



Do you know what country? 



A. 



Not offhand, sir. 



Q. 



Okay. Keep going. 



A. 



Where was I? Next line. Dog network. You 



apostrophe like the first pin to pop a balloon. 
Following pressassociation saying many other things like 
this . 

Following also, pressassociation, restrict 
supply equal value increases, yes. 

Next line. Dog network. Oh, yeah. OSC went 
haywire digging into IS . 

Q. Let me stop you there. Do you know what OSC 

refers to in these chats? 

A. Open source center. 

Q. Okay. Keep going. 

A. The next line, pressassociation, stating U.S. 

DOD has another tact though, dump billions in free, 
quote, news, quote, content. Next line also 
pressassociation, yes. Or yay. Pardon me. Following 
line, also pressassociation, that apostrophe, something 
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we want to mine entirely, B T W. 

Q. Now, when pressassociation says that's 

something we want to mine entirely by the way, what are 
they referring to? 

A. My opinion would be they are looking to — 

THE COURT: Sustained. Speculation. 

Q. Now, what does pressassociation say below 

that ' s something we want to mine entirely by the way? 

A. That line it reads, I have an account there, 

but changed IPS too quickly. 

Q. And what does dog network say? 

A. The following line, usually it's pretty dull 

reading, one or two things a day, but it's like 25 for 
today alone . 

Q. Keep going. 

A. The following from pressassociation. Just 

FBIs or an analysis included. 

Following dog network. No analysis, too 

early . 

Continuing, dog network. 24 to 48 hours it 
takes for analysis, if done. 
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Q . Let me stop you there . What ' s your 

understanding of what open source center is? 

A. My understanding is the collection by the 

intelligence, an operation of the intelligence community 
that collects information that is available to the 
outside world, not classified, but it is publicly 
available though maybe not directly or easily find. It 
would include things such as news sources, various public 
records, databases and the like. 

Q. And I want to ask you one more thing. When 

pressassociation says that ' s something you want to mine 
entirely by the way, would you agree that 
pressassociation 1 s expressed — 

THE COURT: Let him ask the question. One 

more time . 

Q. Would you agree that pressassociation is 

expressing some interest in something? It ' s hard to say 
what they're referring to, but — 

A. I think that's a reasonable interpretation, 

yes, sir. 

Q. Now, Captain Tooman asked you earlier whether 
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there was any evidence in the chats that pressassociation 
asked PFC Manning to give them anything. And you said, 
no, there's no evidence of that. Do you still, based on 
your reading of that, something you want to mine entirely 
by the way, do you still feel that way? 

A. I couldn't say with any degree — that doesn't 

sound like a direct question to me, but it's definitely 
something of interest . 

Q. Okay. Now, Mr. Johnson, I want to ask you 

about the disk utility log. Do you know what a strongbox 
is? 

A. Strongbox in this situation refers to an 

encrypted file we found on Private Manning's computer. 

Q. Now, what is the extension for a strong box? 

A. It was DMG. 

Q. So what's essentially the file, what's the 

file name? 

A. It would be an Apple disk image. 

Q. And you said it was encrypted? 

A. Yes, sir. 

Q. Now, were you able to open this strong box? 
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A. 



No, sir. 



Q. 



Do you recall the date the strong box was 



created? 



A. 



No, sir. I'd have to refer. 



Q. 



I'm retrieving prosecution exhibit 125. 



MR. TOOMAN: Ma'am, may I object? Relevance. 



THE COURT: Where are you going with this? 



MR. MORROW: Your Honor, the defense asked 



several questions about what could be recovered from the 
computer. I'm simply referring to a file that the 
forensic examiners couldn't open. 

THE COURT: Overruled. 
BY MR. MORROW: 

Q. I'm handing you the disk utility log, 

prosecution exhibit 125, and I'd like you to find where 
in the disk utility log this strongbox is . 

A. Okay. That would be February 11, 2010. 

Q. And again, you said you could not open this 



file? 



A. 



Yes, sir. 



Q. 



Now, when a file is encrypted, are you able to 
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tell what ' s inside the file? 



A. No, sir. 

Q. So you'd have no idea how large this file is? 

A. No, sir. Not at that time. 

Q. Thank you. Handing prosecution exhibit 125 



back to the court reporter. 

Handing 123 back. 

One last question. Were you able to tell, 
based on your examination, whether files were being added 
to the strongbox throughout the course of PFC Manning's? 

A. I cannot tell that files were being added or 

removed. However, the log indicates that that file had 
been expanded several times, thus the reason I could not 
determine the file size at the time you asked. 

Q. But you wouldn't be able to tell the size of 

the files in there anyway? 

A. The internal contents? 

Q. Yes. 

A. No, sir. 

Q. I'm sorry. I should have asked this when I 

had 23 in front of me, but in your opinion were the chat 
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logs with pressassociation complete? 
A. I could not tell, sir. 

Q. Were there days missing between 5 March and 18 

March? 

A. Yes, sir. 

Q. So it wasn't 5 March, 6 March, 7 March, 8 

March? 

A. No. There were some missing days, sir. 

MR . MORROW : Thank you . I'm handing 
prosecution exhibit 109 for identification back to the 
court reporter and prosecution exhibit 110. 

THE COURT: Any further questions? 

MR . TOOMAN : No , ma ' am . 

THE COURT: I just have a couple. 

THE WITNESS: Yes, ma'am. 

THE COURT: On the strongbox, if you can't 
tell how big a file is, how can you tell if it gets 
bigger? 

THE WITNESS: What we're referring to, his 
question was the contents of what was put into the 
strongbox . The strongbox itself is the container file . 
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It ' s sort of like — it has a similar function to RARs 
and zip, but it's an Apple specific in terms of 
different, it serves a different purpose. So I can tell 
the file size of the DMG itself, but not what's put 
inside. Does that answer your question, ma'am? 

THE COURT: Yes. So is this a large file or 

a small file? 

THE WITNESS: It's fairly significant size, 
sir, or ma'am. 

THE COURT : All right . Anything based on 
that from either side? 

MR. MORROW: No, Your Honor. 

MR. TOOMAN: Just briefly, Your Honor. 



RECROSS EXAMINATION BY MR. TOOMAN: 
Q. Mr. Johnson, you were describing the strongbox 

getting bigger. Would it be fair to say the strongbox is 
kind of like a partition, you're like fencing off an 
area? 

A. No, sir, it's not. It's closer to a zip or 
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RAR type file . 

Q. Okay. The space got bigger? 

A. Yes, sir. 

Q. And you don't know what was in there? 

A. No, sir. 

Q. Could have been anything? 

A. Could be anything. 

Q. Could be pictures of PFC Manning? 

A. It could be anything. I have no indication of 

what ' s in there . 

Q. Could have been videos? 

A. Possible. 

MR. TOOMAN: Okay. Thank you. 
THE COURT: Temporary or permanent excusal? 
MR. MORROW: Temporary, Your Honor. 
THE COURT: Special Agent Johnson, you're 
temporarily excused. Please don't discuss your testimony 
with anyone other than the accused or counsel . 

THE WITNESS: Thank you, ma'am. 
THE COURT: Just prior to reconvening with 
this witness I spoke with counsel briefly in RCM 802 
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conference . I was concerned a little bit with the 
defense line of questioning regarding PFC Manning was 
charged with a variety of different things and that there 
was no evidence the witness had in his report that shows 
a transfer, and I was concerned and I asked Mr. Coombs if 
the defense was challenging the transfers other than the 
Farah video in specification 11 of charge 2 as we've 
already had a plea that established those elements . 

MR. COOMBS: Yes, Your Honor. And in 
response to that, what we are challenging is the date and 
time period which the government has charged these 
releases, not that PFC Manning did them or not. So by 
pleading by exceptions and substitutions we pled to 
certain dates, which we believe the forensic evidence 
supports, that those were the dates in which PFC Manning 
gave the information. Unlike what the government has 
charged in the charge sheet which is a much broader date 
range . 

THE COURT : All right . Thank you . 
Now, looking at the time, is this a good time 
to have a lunch break? 
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MR. FEIN: Yes, ma'am, it is. 
THE COURT: How long would we like here? 
1330 work for both sides? 
MR. FEIN: It does, ma'am. 
THE COURT: All right. 1330. 
(LUNCH RECESS. ) 
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